The analytic detects aa-exec being used to launch a binary under the Trinity, Chrome, or Flatpak AppArmor profiles where the executed target is not the legitimate application those profiles are intended to confine. This behavior aligns with abuse of user namespaces and AppArmor to bypass Ubuntu’s unprivileged namespace restrictions (as seen in CVE-2026-46331). The rule flags executions where the command after -- is invoked via a relative path, resolves outside standard trusted install directories for these applications, or shares the same binary name as the calling parent process. Adversaries may exploit this technique to escalate privileges by tricking aa-exec into granting a namespace-creation capability to an arbitrary binary rather than the intended trusted application.